It contains an integrated SMTP engine in order to send emails. A direct connection with the destination server will be established. The characteristics are described in the following:

From: The sender address is spoofed. Generated addresses. Please do not assume that it was the sender's intention to send this email to you. He might not know about his infection or might not even be infected at all. Furthermore it is possible that you will receive bounced emails telling you that you are infected. This might also not be the case.

• Hiya, Welcome and thank you for joining our community portal. As a paid customer you will receive all the extras as well as up-to-date feedbacks and monthly newsletters. NOTE: Your PAYMENT and LOGIN details are included within the attached file. Services we offer Create your Profile, connect to your friends, upload your picture, and have it Rated by thousands of other network members. Kind Regards Support Team ++ Attachment: No Virus Found File is (Clean) ++ %receiver's domain name from email address% Antivirus Software 2006 - www.%receiver's domain%

• Dear Member, You recently asked us to reset your password by e-mail. TO RESET YOUR PASSWORD see the attached document. NOTE: Please do not reply to this message, Mail sent to this address cannot be answered. Thank you for using %receiver's domain name from email address% ! The %receiver's domain name from email address% Support Team ++ Attachment: No Virus Found File is (Clean) ++ %receiver's domain name from email address% Antivirus Software 2006 - www.%receiver's domain%

• Dear Member, Your account has been activated and awaiting your approval %receiver's email address%. See attached document for payment details and login credentials. 1. Paid members have 100% Download access, you can download unlimited MP3's and Software's for 6 Months! 2. As a paid value member you have unlimited access to over 250,000 files 3. Unlimited bandwith usage, there are no restrictions on the amount you download! See the details to activate your %receiver's domain name from email address% account today. Sincerely,The %receiver's domain name from email address% Support Team ++ Attachment: No Virus Found File is (Clean) ++ %receiver's domain name from email address% Antivirus Software 2006 - www.%receiver's domain%

• Dear Member, Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service. If you choose to ignore our request, you leave us no choice but to cancel your membership. Virtually yours, The %receiver's domain name from email address% Support Team ++ Attachment: No Virus Found File is (Clean) ++ %receiver's domain name from email address% Antivirus Software 2006 - www.%receiver's domain%

Prepend MX strings: In order to get the IP address of the mail server it has the ability to prepend the following strings to the domain name: • gate. • ns. • relay. • mail1. • mxs. • mx1. • smtp. • mail. • mx.

IRC

To deliver system information and to provide remote control it connects to the following IRC Server: